CVE-2026-116586

What it actually does

Parsing of attacker-supplied JSON containing deeply nested arrays or objects exceeds Go runtime stack limits, triggering a stack overflow that terminates the process.

Why it matters to the business

Services relying on the library for token or encryption handling experience sudden crashes, resulting in denial of service and loss of availability for any dependent applications or APIs.

How an attack unfolds

An attacker crafts a JSON payload with excessive nesting and submits it to any endpoint that uses go-jose to parse untrusted input such as JWTs or JWEs; the library's recursive parsing exhausts the stack and crashes the process before any cryptographic validation occurs.

How to fix it

Upgrade go-jose to version 4.1.5 or later; after upgrade, recompile and redeploy all dependent binaries. Where immediate upgrade is not feasible, add input-size or nesting-depth limits before passing data to the library.

How to confirm the fix worked

Confirm the running binary links against go-jose 4.1.5 or newer; replay a known deeply nested test vector and verify the process no longer crashes.

Typical attack path

1. Identify an application endpoint accepting JSON processed by go-jose
2. Generate a deeply nested JSON structure exceeding Go stack depth
3. Transmit the payload via the normal request path
4. Observe process termination and service outage

How to detect it

Review application and system logs for abrupt terminations or panic messages occurring immediately after receipt of JSON payloads on paths that invoke go-jose parsing functions; correlate with high nesting depth indicators if request logging captures raw bodies.

What your security team should do

• Immediately inventory all Go services that import go-jose and schedule upgrade to 4.1.5 within the next patch cycle
• Add runtime resource limits or request-size caps as a temporary defense-in-depth measure
• Monitor application crash logs for stack-overflow signals on JSON parsing paths